Shopping Centre Cyber Security: The Risks Between the Stores

Tuesday, November 10th, 2026

Most cyber-attacks won’t start at a retailer’s POS system.

They’ll start with the systems that keep the whole destination running.

A shopping centre can be hit by a cyber incident without a single retailer being compromised.

Many centre management teams focus on risks to the inline tenants, but the biggest threat often sits within the shared services that keep the destination operating. CCTV, access control, parking systems, public Wi-Fi, building management systems and supplier access can all become targets.

This article explains where those risks exist, why they matter and what centre management teams can do to reduce them.

Different cyber risks for shopping centres and inline stores

Most cyber security advice for retail focuses on online shopping, payment systems, customer accounts and point of sale technology.

Shopping centres and retail parks work differently.

In most cases, retailers manage their own POS systems, networks, devices and internet connections. The centre team manages the shared environment that supports the entire destination.

That means the cyber risks are different.

CYBER RISK LANDSCAPE

Individual retailers and the shopping centres that host their stores and operate shared infrastructure

Different systems, shared dependencies, overlapping attack paths

INDIVIDUAL RETAILERS

Retailer-owned technology and data

  1. 1E-commerce disruption and fraudOnline ordering, carts and payment gateways
  2. 2POS and payment compromiseTills, payment environments and gift transactions
  3. 3Customer and loyalty data breachAccounts, profiles, preferences and loyalty schemes
  4. 4Store network and endpoint attackDevices, local networks and internet connectivity
  5. 5Ransomware and operational outageLoss of availability across stores and systems
  6. 6Warehouse and fulfilment disruptionStock movement, dispatch and order delivery
  7. 7Account and credential compromiseStore managers, employees and administrators
  8. 8Retailer impersonationCompromised accounts used to deceive centre teams

SHARED / CROSS-ESTATE

Risks that can affect both parties

  1. 1Identity compromiseAttackers log in using stolen credentials
  2. 2AI-enabled phishingMore convincing and scalable social engineering
  3. 3Business email compromiseFraudulent invoices, payments and urgent requests
  4. 4Executive impersonationAuthority misused to pressure staff into action
  5. 5Third-party and supply-chain attackTrusted suppliers become an access route
  6. 6Customer and marketing data exposurePersonal information and engagement platforms
  7. 7Website or portal compromisePublic services, content and customer journeys
  8. 8Weak incident readinessDelayed detection, containment and recovery

SHOPPING CENTRE OPERATOR

Centre-run infrastructure and shared estate

  1. 1Supplier ecosystem compromiseRemote access, credentials and physical permissions
  2. 2BMS and smart-building attackHVAC, lighting, escalators, heating and energy
  3. 3Access-control compromisePlant rooms, roofs, yards, lifts and control rooms
  4. 4CCTV compromise and privacy breachUnauthorised access, outages and data exposure
  5. 5Parking and ANPR disruptionOutages, lost revenue, fraud and vehicle data exposure
  6. 6Public Wi-Fi attack or abuseRogue access points, harvesting and interception
  7. 7Digital-signage compromiseDefacement, scam QR codes and false alerts
  8. 8Tenant-assisted social engineeringTrusted retailer identity used to obtain access or data

KEY TAKEAWAY  •  Attackers can move through trust relationships even when retailer and centre systems are technically separate.

Source: Geraint email shopping centres.docx

The systems visitors never see

The best shopping centre technology is the kind visitors never notice.

Shoppers rarely think about the systems working behind the scenes, from heating and ventilation controls to access management, ANPR cameras, parking platforms, digital directories and public Wi‑Fi. Yet these technologies are essential to keeping the centre safe, efficient and enjoyable.

When they work well, they fade into the background. However, when they fail, the impact is immediate. Visitors become frustrated, operations slow down, staff face disruption, and the centre’s reputation can quickly suffer.

Your suppliers can become your biggest cyber risk

Shopping centres depend on a large network of suppliers.

Facilities management companies, security providers, CCTV vendors, parking operators, lift maintenance firms, marketing agencies and building technology specialists all need some level of access.

Every supplier creates another potential route into the organisation and its critical systems.

A cybercriminal only needs to find one weak link.

That’s why supplier security should be treated as a business risk, not just an IT issue. Centre management teams need to understand who has access, what they can access and whether that access is still required.

Not every attack is technical

Some of the most successful cyber-attacks don’t involve hacking at all.

A criminal may compromise a supplier email account and send a fake invoice.

They may impersonate a contractor and ask for access to a restricted area.

They may pose as a retailer and request CCTV footage, building plans or door access codes.

The request looks genuine because it comes from someone the team already trusts.

These attacks are often simple, convincing and highly effective.

Ask a simple question: who has access?

Many organisations spend time protecting technology but forget to review who can get into it.

A good starting point is a simple access review.

Ask:

  • Who has administrator access?
  • Which suppliers can access systems remotely?
  • Which former employees still have active accounts?
  • Which contractors still have permissions they no longer need?
  • Which critical systems depend on shared accounts?

The answers to the above questions often reveal risks that are easy to fix.

Be ready before something goes wrong

“There’s no harm in hoping for the best as long as you’re prepared for the worst”.

Stephen King, Author.

Every shopping centre has procedures for fire alarms, evacuations and health and safety incidents.

Cyber incidents should be treated in the same way.

Centre management teams should know:

  • Who leads the incident response.
  • Which suppliers need to be contacted.
  • What systems are most important.
  • How visitors and tenants will be informed.
  • How the centre will continue operating if a critical service becomes unavailable.

The worst time to create a plan is during an incident.

The bottom line

Cyber security is no longer just an IT problem.

For shopping centres and retail parks, it is an operational issue, a supplier management issue and a business continuity issue.

Retailers may manage their own technology, but centre management teams remain responsible for the systems that keep the destination open, safe and running.

Understanding those systems, controlling access to them and preparing for disruption can significantly reduce risk.

Get in touch

Do you know who has access to your critical building systems?

Modern Networks helps shopping centres, retail parks and commercial property operators identify cyber risks across their shared technology estate, suppliers and operational systems.

Speak to our team about a retail destination cyber security review and discover where your biggest risks may exist.

You can also download our Cyber Security for Shopping Centres guide as a PDF or view as a digital flipbook. No form filling needed, just click below to download instantly.

Cyber Security for Shopping Centres Guide View the interactive flipbook

References

National Cyber Security Centre, Operational Technology: OT definition and guidance on enterprise links, safety, reliability and availability. https://www.ncsc.gov.uk/collection/operational-technology

National Cyber Security Centre, OT asset categorisation: Asset criticality, exposure and availability. https://www.ncsc.gov.uk/collection/operational-technology/definitive-architecture-view/principle-3

National Cyber Security Centre, supply chain security: Control and oversight of supply chain security. https://www.ncsc.gov.uk/collection/supply-chain-security

National Cyber Security Centre, multi factor authentication: Recommended types of MFA and the stated order of preference. https://www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services/recommended-types-of-mfa

Information Commissioner’s Office, video surveillance guidance: Data protection guidance for CCTV, ANPR and related systems. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/cctv-and-video-surveillance/guidance-on-video-surveillance-including-cctv/

British Retail Consortium, Cyber Resilience Toolkit for Retail: Retail cyber resilience guidance for business leaders. https://brc.org.uk/news-and-events/news/technology/2024/cyber-security-toolkit-for-retail/

Share this page